cybr.cx Daily Digest — May 18, 2026

Critical Vulnerabilities

CVE-2026-8719 | AI Engine WordPress Plugin | CVSS 8.8 (HIGH)
The AI Engine plugin (v3.4.9) for WordPress has a privilege escalation flaw in its MCP OAuth bearer-token path. Any authenticated user — including subscribers — can obtain MCP-level access without administrator privileges, simply by presenting a valid OAuth token. Sites running AI-powered chatbot or MCP integrations should update immediately; subscriber-to-admin escalation is trivially exploitable and a favourite entry point for automated campaigns targeting WordPress installs at scale.

CVE-2018-25333 | Nordex N149/4.0-4.5 Wind Turbine Web Server | CVSS 8.2 (HIGH)
An unauthenticated SQL injection in the login parameter of the turbine's web interface allows an attacker to extract the database and bypass authentication entirely — no credentials required. Industrial control systems exposed to the internet are high-value targets for both espionage and disruptive actors; operators should audit whether these management interfaces are network-isolated and apply vendor patches or firewall rules immediately.

CVE-2018-25330 | Joomla! EkRishta Extension (v2.10) | CVSS 8.2 (HIGH)
A pairing of persistent XSS and SQL injection in the EkRishta dating/community extension allows attackers to inject scripts via profile fields and extract database contents via the phone_no parameter. Persistent XSS in profile views is particularly nasty — a single compromised profile can silently attack every administrator or moderator who views it.

CVE-2018-25322, CVE-2018-25323 | Allok Media Tools (AVI MPEG Splitter 1.2 / AVI DivX to DVD Converter 2.6.1217) | CVSS 8.4 (HIGH)
Both legacy Allok media applications contain local buffer overflows (stack-based and SEH-based respectively) triggered by malicious license name strings. While local-only exploitation limits immediate blast radius, these are useful primitives in sandbox-escape or privilege-escalation chains — and the "paste into license field" attack vector is trivially social-engineerable in targeted attacks against creative or media production environments.

Headline News

A researcher claims Microsoft hid a backdoor in BitLocker — and released working code
A security researcher has published an exploit alongside claims that Microsoft deliberately introduced a covert access mechanism into BitLocker, Windows' full-disk encryption feature. The proof-of-concept code has been publicly released, meaning any claim of "theoretical risk" is now moot — the exploit is in the wild. For practitioners, this is immediately significant: BitLocker is the default encryption layer for millions of enterprise endpoints, and if the access path is real and unpatched, it fundamentally undermines disk-level protection assumptions in threat models everywhere. The story is still developing, and Microsoft has not acknowledged the claim at time of publication — but the release of working code forces the question to be taken seriously regardless of vendor response.

Anthropic's Mythos AI helped build a working macOS privilege escalation exploit in five days
Security researchers used Anthropic's Mythos Preview model to develop a functional macOS exploit — achieving root access from a standard user account — in approximately five days, bypassing a protection that had held for five years. The finding is a sharp illustration of how AI-assisted vulnerability research is collapsing the time-to-exploit curve: what once required weeks of specialist effort is now measurable in days with the right tooling. For blue teams, this is a force multiplier problem: adversaries with access to capable AI models can iterate on vulnerability research faster than defensive cycles typically operate. macOS-heavy environments should review local privilege escalation mitigations and monitor for unusual sudo or privilege escalation activity.

Microsoft quietly patches Azure Backup vulnerability, refuses CVE — researcher goes public
A researcher identified what they characterise as a critical vulnerability in Azure Backup for AKS, reported it to Microsoft, and was told the behaviour was "expected" and that "no product changes were required." Microsoft subsequently made quiet modifications to the service while maintaining no CVE would be issued. The dispute highlights a structural problem in coordinated disclosure: when a major vendor controls both the affected platform and the CVE acknowledgement decision, researchers face a credibility gap with no clean resolution. For practitioners managing Azure Kubernetes workloads, the episode is a reminder that "no CVE" does not mean "no risk" — monitoring vendor changelog entries for undocumented security fixes remains a necessary hygiene habit.

Schrödinger's Feed

Quantum computing comes to the server rack

Equal1 has unveiled RacQ, a silicon-spin quantum computing system built to slot into a standard 19-inch data centre rack and operate alongside classical hardware as a peer-level compute resource. This form factor shift matters: it signals a move away from quantum-as-exotic-lab-instrument toward quantum-as-infrastructure, with the silicon-spin approach offering a credible path toward co-integration with conventional silicon fabrication. The implications for cryptography aren't immediate — fault-tolerant, cryptographically relevant quantum scale is still some distance away — but the data-centre-native form factor accelerates the timeline for organisations to take post-quantum cryptographic migration seriously. If quantum compute becomes a rack resource like a GPU, the gap between "theoretical threat to RSA/ECC" and "operational threat" closes faster than most enterprise PQC roadmaps currently assume.

/dev/random

Someone has taken a $80 RK3562 Android tablet — the kind of device that usually ends up forgotten in a drawer after a firmware update breaks the YouTube app — and coaxed a full Debian Linux workstation out of it. The project, posted to GitHub, involves enough custom kernel patching to make it genuinely impressive rather than merely stubborn. It's a useful reminder that "Android tablet" is increasingly just a description of a chassis and a bootloader, not a permanent sentence. Also, $80 for a Debian workstation is a better price-to-smugness ratio than most home lab setups.